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Abstract — It has been shown recently that coding for the 
Gaussian Wiretap Channel can be done with nested lattices. A 
fine lattice intended to the legitimate user must be designed as a 
usual lattice code for the Gaussian Channel, while a coarse lattice 
is added to introduce confusion at the eavesdropper, whose theta 
series must be minimized. We present a design criterion for both 
the fine and coarse lattice to obtain wiretap lattice codes for the 
Rayleigh fading Wiretap Channel. 

I. Introduction 

A. Related work 

The wiretap channel was introduced by Wyner ||9l as a dis- 
crete memoryless broadcast channel where the sender, Alice, 
transmits confidential messages to a legal receiver Bob, in the 
presence of an eavesdropper Eve. Wyner defined the perfect 
secrecy capacity as the maximum amount of information that 
Alice can send to Bob while insuring that Eve gets a negligible 
amount of information. He also described a generic coset 
coding strategy, where both data and random bits are encoded, 
in order to confuse the eavesdropper (see also [7|). The 
question of determining the secrecy capacity of many classes 
of channels has been addressed extensively recently, yielding a 
plethora of information theoretical results on secrecy capacity 
(see in for a survey of many such results). 

There is a sharp contrast with the situation of wiretap 
code designs, where very little is known. The most exploited 
approach to get practical codes so far has been to use LDPC 
codes (see fE] for binary erasure and symmetric channels, 
im for Gaussian channels with binary inputs). Finally, lattice 
codes for Gaussian channels have been considered from an 
information theoretical point of view in f3\. 

A design criterion for constructing explicit lattice codes 
on the Gaussian Wiretap channel has been proposed in HI, 
based on the analysis of Eve's correct decision probability. 
This design criterion relies on a new lattice invariant called 
"secrecy gain" which is based on the lattice theta series. The 
secrecy gain of unimodular lattice was further studied in 

B. Contribution and organization 

We propose here to find the appropriate design criterion for 
both the wiretap fast fading and block fading channels and to 
give some intuition on lattice codes which are optimal for this 
criterion. 



This paper is organized as follows. Section II presents the 
system model and recalls the design criterion for the Gaussian 
wiretap channel. Sections III and IV are the main contributions 
where we give the code design criterion for, respectively, the 
fast fading and the block fading channel. The particular case 
of algebraic lattices is discussed in both cases. 

II. System Model and the Gaussian case 

A. Fast fading channels 

Alice wants to send data to Bob on a wiretap fading channel, 
where an eavesdropper Eve is trying to intercept the data 
through another fading channel. Perfect channel state informa- 
tion (CSI) is assumed at both receivers. Thus it is possible to 
remove the phase of the complex fading coefficients to obtain 
a real fading which is Rayleigh distributed, with the aid of an 
in-phase/quadrature component interleaver to guarantee that 
the fading coefficients are independent from one real symbol 
to the next 15] sec 2.1]. This is modeled by 
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where x e R" is the transmitted signal, and denote the 
Gaussian noise at Bob, respectively Eve's side, both with zero 
mean, and respective variance ct^ and aj, and 
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are the channel matrices containing the fading coefficients 
where hb^i,he,i are complex Gaussian random variables with 



variance a 
distributed. 



h,b 
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SO that \hh 



are Rayleigh 



. . ,N, with parameter cr^ ^, resp. a 



We assume that Bob has a good SNR, but that ^ Nq « 
Ni = cTg, so that Eve has a poor SNR with respect to Bob. 

The transmitted codeword x e M" comes from a lattice A;, 
intended to Bob, that is 

X = MfeU, u e Z" 



where Mi, is the generator matrix of the lattice A;,. We can 
rewrite the channel accordingly: 
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y = d\ag{hb)MbU + Vb 
z = diag(he)MbU + Ve, 

and we set 

MbM, = diag(hf,)M6, Mb,h^ = diag(he)Mb 

which can be interpreted as the generator matrix of the lattice 
Ab,hb, resp. Af,_hc- In words, these are the lattice intended to 
Bob seen through Bob's, resp. Eve's channel. 

Coset encoding is used, namely the lattice Ab is partitioned 
into a union of disjoint cosets of the form 

Ae +C, 

with Ae a sublattice of A;, and c an n-dimensional vector To 
send k bits s of data, we need 2'' cosets 



to be labelled by 



Ab =U^^l(Ae+Cj) 



S l-> Ae + Cj(s 



Alice then randomly chooses a point x e Ae + Cj(s) and sends 
it over the wiretap channel. This is equivalent to choose a 
random vector r e Ae. The transmitted lattice point x e Ab 
is finally of the form 

X = r + c e Ae + c. (4) 

We can as above set 

Me,h, = diag(hb)Me, Me,h, - diag(he)Me 

which are the generator matrix of the lattice Ae^hb- resp. Ae.h^ 
corresponding to the lattice Ae twisted by the channel of Bob, 
resp Eve. Bits are transmitted by AUce at a rate equal to i? = 
Rs + Rr where Rg is the secrecy rate of this transmission and 
Rr is the rate of random bits. 
The parameters involved are: 

• Ab is the lattice intended for Bob, 

• Ae is a sublattice of Ab that encodes the random bits 
intended for Eve, 

• n is the dimension of both lattices, 

• V (Ab) (resp. V (Ae)) is the fundamental parallelotope of 
Ab (resp. Ae), 

• Vol(Ab) (resp. Vol(Ae)) is the volume of Ab (resp. Ae) 
where by definition 

Vol(Ab) / dx = dct(A-fbMb^)i/2, 

"'V(Ai,) 

• the unnormalized second moment U{Kb) is 



U{Kb)^ I ||x|pdx. 

V(A,) 



B. Gaussian channels 

Recall from [IJ that the probability Pc^b of Bob's (resp. Pc,e 
of Eve's) correct decision in doing coset decoding when Ab 
is sent over a Gaussian channel is: 

Feb = V / e-ll"ll^/2-^^du 

(V27rcrb)" rtA, -^ViA.+r) 
Pee - y I e-ll-ll'/^'^edu. 

Since Ab is designed for Bob to correctly decode, the 
received point is most likely to be in the coset with r = 0, so 
that 

1 
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(V27rcrb)" Jv{At) 

As for Eve, a^. is assumed larger than ab, so we need to take 
into account the cosets where r 7^ 0, By writing u = w + r, 
w G Ab, a Taylor expansion of e~ll'^+'"ll at order 2 gives 

l + _i(..w) + ^||w|P + ^(..w)')+o(-l 
and we get, by neglecting O ( ^ ) , that 
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noticing that X^reA /v(At,) ^)'^^ ^ *-* since the sum is 
over r € Ag, and for each r in Ae, — r is also in Ae. 

The probability of making a correct decision for Eve is then 



^Vol(Ab) 



and the goal is then to minimize 

E 

reAe 

By further neglecting the terms in O , we further simplify 
Eve's probability of correct decision to 

Vol(Ab' 
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III. Code design criterion: Fast Fading Channels 

For a given realization of the fading h, the channel (O can 
be seen as the Gaussian wiretap channel 



y = Mb,h,u + Vb 

Z = Mb,heU + Ve, 

and we note that for r e Ag.h^ 

n 

||r||2 = ||diag(he)MeU|l2=^|/,e,, 

1=1 

with u e Z" and x e Ag. 
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Since probability computations for Bob, which is the clas- 
sical problem of transmitting over a fast Rayleigh fading 
channel, have been extensively studied in the literature (e.g. 
im sec 2.3]), we focus on Eve. 

A. Eve 's probability of correct decision 

The probability of Eve correctly decoding on channel (|7]i is 
from (|6]), for a given fading realization 



since for a > 0, we have 
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Thus X^xeAe nr=i (flZT l becomes 
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Vol(Ab,hJ =ni^-'»l^°l(^'' 
and using (|8]l, we get 
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and (fT2l i can be rewritten as 



yielding the following approximate expression for Pc,e,h^ 



1 



n/2 



1 



i/2 



V0l(A,)n|/ie,.| 

1=1 xGAc 

Vol(A;,) ^ f[ [\h,^^\e~ 



/ \n n . 

^"-fe v„i(A.)i:n- — ^ 



(11) 



xeAc i=l \ / 

The average probability Pc,e of correct decision is now: 

/ I \ «/2 



Now, let 7e denote Eve's average SNR defined as 
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We finally get 
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As Pc^e is the average probability of correct decision for 
Eve, it has to be minimized. We remark that the terms inside 
the summation in (fT4l i are very similar to the terms we have 
when we express the error probability on a Rayleigh fast 
fading channel Q. We further have 



since the |/ie, j| are independently distributed, i = 1, . . . , n. Set 
Pi ~ \he.i\ which is Rayleigh distributed with parameter a\ ^ 
and pdf 



n 
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Thus 
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where 7e is big enough to consider as negligibl^ and 
j7x is the set of indices i such that Xi ^ and dx = |i7x| is 
called the diversity of x. We have that dx is at most n, and if 
it is n for all x G Ag, then we have a full diversity lattice Ae 

d-x. = n, Vx G Ag. 



3/2 



'This assumption is realistic since Ae is a lattice which should be 
"perfectly" decoded by Eve. 



In this case, using ( fT4b and ( fTSl ). we derive 



' voi(A,)^n ' 
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B. Full-diversity algebraic lattices 

Full-diversity lattices can be obtained using algebraic lat- 
tices |5|, that is lattices obtained by embedding the ring of 
integers of a number field. Let K/Q be a number field of 
degree n with embeddings (Ti , . . . , (7„ into C, and denote 
by Ok its ring of integers. We assume that the lattice Ag 
is obtained via the canonical embedding of either Ok or an 
integral ideal I of Ok- In that case, Xi — (Ji{x) for x e Ok- 
Then 

IV. Code design criterion: Block fading channels 

We now consider the case when the channel between Alice 
and Bob, resp. Eve, is block fading with coherence time L, 
instead of being fast fading, that is: 



xeAe i=l 

1 



(16) 



Y = d\ag{hb)X + Vb 
Z = d\ag{K)X + Ve, 

where the transmitted signal AT is a n x L matrix, Vf, and 
Ve are n x L matrices denoting the Gaussian noise at Bob, 
respectively Eve's side, both with coefficients zero mean, and 
respective variance and a^. The fading matrices are given 
explicitly in When L = 1, we are back to the fast fading 
case. 

In the setting of ( fTSI l, we assume that the fading is con- 
stant over L time slots and that the channel coefficients 
hfj^i ■ ■ . , hh^n, resp. h^^i, . . . , h^.n, on the n parallel paths 
from Alice to Bob, resp. Eve, are supposed independent. In 
order to focus on the dimensional lattice structure of the 
transmitted signal, we vectorize the received signal ( fT6b and 
obtain 

vec (y) ^ vec (diag (hb) X) + vec {Vb) 
^diag(h6) \ 

vec(X) + vec(T4) 

cliag(hfc)y 

vec (Z) = vec (diag (he) X) + vec (Ve) 
^diag(he) \ 

vec(X) + vec(ye)- 

diag(he)/ 

We now interpret the n x L codeword X as coming from a 
lattice by writing 

vec(X) = MfcU, resp. vec(X) = M^u (17) 

where u G Z^" and Mf, (resp. Mf.) denotes the Ln x Ln 
generator matrix of the lattice intended to Bob (resp. Eve). 



Thus in what follows, by a lattice point x e Ab (resp. Ae), we 
mean that 

X = vec(X) 

with vec(X) as ([TtI i. 

By setting as for the fast fading case 

Mb^h,, = diag(diag(hb), . . . , diag(h6))Mb, 
MbM^ = diag(diag(he),...,diag(he))Afb 

we can rewrite (fT6] l as 

vec(y) ^ Afb,h,u + vec(Vb) 
vec(Z) = A/b^h^u + vec(V'e), 

where Mb.ht, resp. Afb,he can be interpreted as the lattice 
generators of the lattices Ab^h^, resp. Ab^h^ and thus we get 
in particular for Eve 

Vol(Ab,hJ = |^ni/^e,<|^ Vol(Ab). 

A. Eve 's probability of correct decision 
First, we have from (|6]l that 
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where Ae is the lattice with generator matrix Afe.he = 
diag(diag(he), . . . , diag(he))Afe, x = vec(A') as explained 
in ( [TtI i and ||r|p is computed as in (O. Since A/g^he contains 
L copies of diag(he), we can further adopt a double indexing 
for coefficients of x and write 

hn L n n L 



j=i 1=1 



i=l 



3 = i 



Note for further usage that since x = vec(Ar), Xij actually 
corresponds to the coefficient of X, and l^u P is 

a summation over the L components of the ith row of X, that 
we denote by x^ = (xn,. . . , x^l). 

The average probabiUty of correct decision for Eve is then 

voi(Ab) _ / _ ^e.pE^=ih.,r 



p — 



(27ra2)- 
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where 
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since for a > 0, we have 



dx — 



r(f + 1) 
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Now X^xgA n"=i is given, as done earlier, by 




xGA, 
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Recall from ( fT3] l that Eve's average SNR is 



We finally conclude that 
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xeA.«=i l + j|x,|| 7, 



In the same way as in ( fTsT l. we can express the term inside the 
summation by assuming that Eve's SNR is high compared 
to the minimum distance of Ae and get 



n 



(1+ ||X,|| 7,) - le'- ' »=1 



1 " 1 
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if we assume that none of the ||xi|| are equal to zero. This 
corresponds to the case where the in-dimensional lattice Ag 
has diversity order at least L{n — 1) + 1. Indeed, a diversity 
of L{n — 1) or less means that at most L{n — 1) coefficients 
of a non-zero lattice vector are non-zero, thus there could be 
L zero coefficients, which, if all located on the same row i, 
would make ||xi|| =0. This cannot happen if the diversity is 
at least L{n - 1) + 1. 

In this case, we derive that 
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B. Full-diversity algebraic lattices 

Again, to make sure that full diversity is achieved, we 
propose to use algebraic lattices. But this time, we need to 
control the terms in ( fTST l. that is essentially the sum 
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Let -?f/Q be a number field of degree n, with n embeddings 
(ci, cr2, . . . , (Tn) into C, and ring of integers Ok- Recall that 
a vector point x e Ae is obtained from x = vec(X), and X 
is the codeword sent. Let xi be the first row of X, and take 
Xi = (Ji (xi), so that each row of X is obtained by conjugating 
its first row. Alternatively, each column can be seen as a lattice 
point from the algebraic lattice build over Ok. In this case, it 



is enough for this lattice to be of diversity n to guarantee that 
||xi|| 7^ for all i. Indeed, for every non-zero coefficient of 
the first row xi, all the corresponding columns will have non- 
zero coefficients. Conversely, each zero coefficient on the first 
row gives a column of zeros, and to have ||xi|| = for one i 
means to have | |xi 1 1 =0 for all %, that is sending X containing 
only zeros. Now 

L L 

and 

n n n 



i=l 



i=l 



i=l 



The sum in ( fT9] l finally becomes 
1 



En- 
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V. Future Work 

Current and future work naturally involves (i) the analysis 
of the wiretap MIMO Channel so as to determine the cor- 
responding code design criterion, and (ii) the construction of 
lattices optimized for fast fading wiretap channel, block fading 
wiretap channel, and finally MIMO wiretap channel. 
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